- cypherpunks-legacy@lists.ogf.org

whistleblower newsgroup?
by ld231782＠longs.lance.colostate.edu 23 Feb '93

23 Feb '93

Mulling over K. Goen's somewhat rambling, irate, and paranoid prose (but nevertheless mildly entertaining) has caused various random ideas to pop into my head on how to get pseudonymity/anonymity into the mainstream and even the spotlight, toward the goal of widespread public recognition, acceptance, and use to the point of dependence, all in a nonthreatening way. First of all, there have been a lot of famous uses of anonymity and pseudonymity, esp. in literature. It might be interesting for PR purposes to collect a long list of everyone who has used aliases. When people start saying `wow, he's my favorite author, I didn't know he was someone else' that would be great. A sort of long history of anonymity and pseudonymity would be perfect. Deep Throat, Voltaire, Mark Twain, I think even Scott Fitzgerald was a pseudonym. Also, what about anonymous letters? Did Martin Luther first post the `indulgence complaints' anonymously? I'm sure there's some cases where anonymous information changed the course of world history significantly (esp. during wars). Anonymous tips leading to big busts, that kind of thing. (Remember the Lockerbie plane terrorist crash? There was an anonymous tip to authorities that virtually pinpointed the flight origination and bomb mechanism.) Anybody know any, please send them to me, and I'll summarize to the group and credit you. (please give references where possible.) If it works out I'll donate it to K. Goen, assuming he hasn't been arrested or hospitalized by then :) Next idea: How about a newsgroup devoted to `whistleblowing' where anonymity is encouraged? It could even be `anonymously moderated' where all the postings are guaranteed to go through an anonymous server before posting. (Whoever wanted to be *really* sure could anonymize the message before posting.) I haven't seen *any* newsgroups dedicated to looking at government abuses from the "inside" (this would be for employees esp.) I can imagine all kinds of neat little secrets about our government's illustrious practices leaking out.. The potential for `good' is good, esp. if the notices refer to ways of *saving money* and *eliminating waste*. A sort of patriotic taxpayer watchdog group! Although the possibility for `bad' is good too, people might just use it as a way of getting revenge. (Despite what others may think here, I hope it wouldn't turn into a sort of perpetual incitement to revolution and anarchy...) The group might overlap into private industry too, although the federal government assuredly provides the most fodder... Now, think about how much immense *press* and *publicity* that some government abuses get. They can really be legendary (remember the $600 toilet seats?). Now, suppose that just coincidentally a major press story that got out *originated* in this anonymous group. Wow! That would be a story in itself, worthy of the evening news. Can't you imagine some blank-faced, clueless reporter saying ``the story was first reported on a network bulletin board devoted to anonymous reporting of government abuses.'' Allright! Hey, it could get to the point where reporters start watching it for hot tips! There are already a lot of big Washington groups that try to monitor the government, and this could be a real catalyst for them. So I'm putting out the idea. Maybe someone well-versed in the newsgroup addition protocol can take care of the details. (Ladies and gentlemen, fasten your seat belts, I think we're in for some hellacious turbulence ahead...)

3 2

No Subject
by nowhere＠bsu-cs.bsu.edu 23 Feb '93

23 Feb '93

-----BEGIN PGP SIGNED MESSAGE----- This is a longer response to the warning posted by Xavier. > Beware of the message about the security bug in the > anon.penet.fi software! Indeed. > If you do as requested, and send your true email address to > an5877(a)anon.penet.fi then he will see both your true email > address and your anonymous address (if you have one - if you > don't, you will be assigned one and he will see that). Any > future use you make of this anonymous server (say, to post > anonymously) will appear under that same anonymous address - and > this person will know your true email address that goes with > it. You got me. I meant only slight malice here: I had intended to "expose" a few email/anon associations to highlight the problem. The problem became apparent to me when I sent pseudonymous mail to a prominent person on this list; his reply exposed his pseudonymous id at anon.penet.fi, surely without his knowledge. > an5877's message appears to be a trick, designed to collect > anonymous/real address pairs. Johan Helsingius should take > action against this trickster. Since he is learning other > people's real addresses, perhaps it would be appropriate for his > own real address to be revealed. Now that would be a _very_ serious "bug" in the anon.penet.fi remailer (or, more accurately, in its administration); I am confident Johan Helsingius will reject this suggestion. > But, this does point out that these systems which automatically > assign anonymous addrsses have several security flaws. Johan > has already had to introduce a "password" feature to make it > more difficult to send fakemail that appears to be from a > particular email address through the server, thus revealing the > corresponding anonymous address when it is delivered. I think that merely masks the real problem. > an5877's trick is a variant on one discussed in > news.admin.policy where it is pointed out that you can mail to > someone via anon.penet.fi and ask for information; when the > return mail comes back it will be from that person's anonymous > address. So again you can pair up real and anonymous > addresses. I missed that discussion, or I wouldn't have wasted your (our) time. > These are serious problems. We need some discussion of how to > avoid these simple tricks for defeating the anonymity while > still having an easy-to-use system. Any ideas? For starters, I think the default behavior of anon.penet.fi is badly broken. But a more serious problem with anon.penet.fi and the other remailers I am aware of is the necessity that we pseudonymous clients have to rely on the integrity of their administrators to keep our pseudonyms private. In the face of social pressure, such as Xavier's, that may be asking a lot. > ::Xavier:: DEADBEAT -----BEGIN PGP SIGNATURE----- Version: 2.1 iQBFAgUBK4lr4/FZTpBW/B35AQGqeAF/UBefmNprQacueYazdvhAKMF4nA+2vl44 /+FMACnWjd7yaoG99VeyhO/S6vptT1UB =yZRb -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind system, any replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi. *IMPORTANT server security update*, mail to update(a)anon.penet.fi for details.

1 0

No Subject
by nowhere＠bsu-cs.bsu.edu 23 Feb '93

23 Feb '93

-----BEGIN PGP SIGNED MESSAGE----- > I would like to let everyone who hasn't already figured it out > know that I did *not* originate the message that was posted to > Cypherpunks through my account. I do not know where it came from, > but it reached my account with the destination address of the > cypherpunks list because the message that came back to me from the > list said that "Anonymous <nowhere(a)bsu-cs.bsu.edu>" originated the > message. That indicates that it went through the remailer. If it > were from me, it would say "Chael Hall <nowhere(a)bsu-cs.bsu.edu>" > as the return address. Another identifying characteristic is the > "X-Remailed-By: Anonymous <nowhere(a)bsu-cs.bsu.edu>" header line. > Just remember, don't believe everything you read. In the case of pseudonymous mail, don't believe _anything_ you read! I don't see why Chael Hall is going to all this trouble to refute a message that I don't even remember ... Did I miss something important? (Or outre?) Or (duh!) is he talking about _my_ earlier message? DEADBEAT -----BEGIN PGP SIGNATURE----- Version: 2.1 iQBFAgUBK4lx8vFZTpBW/B35AQGnfwF/YdHtdc6B+oslFno9+rCowlph7GteEZF+ ot8jlZRA+gW+Sa1bpBUkV6ZryBlHYQMQ =KMZW -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind system, any replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi. *IMPORTANT server security update*, mail to update(a)anon.penet.fi for details.

1 0

Re: Remailer Use
by an5877＠anon.penet.fi 23 Feb '93

23 Feb '93

-----BEGIN PGP SIGNED MESSAGE----- > I would like to let everyone who hasn't already figured it out > know that I did *not* originate the message that was posted to > Cypherpunks through my account. I do not know where it came from, > but it reached my account with the destination address of the > cypherpunks list because the message that came back to me from the > list said that "Anonymous <nowhere(a)bsu-cs.bsu.edu>" originated the > message. That indicates that it went through the remailer. If it > were from me, it would say "Chael Hall <nowhere(a)bsu-cs.bsu.edu>" > as the return address. Another identifying characteristic is the > "X-Remailed-By: Anonymous <nowhere(a)bsu-cs.bsu.edu>" header line. > Just remember, don't believe everything you read. In the case of pseudonymous mail, don't believe _anything_ you read! I don't see why Chael Hall is going to all this trouble to refute a message that I don't even remember ... Did I miss something important? (Or outre?) Or (duh!) is he talking about _my_ earlier message? DEADBEAT -----BEGIN PGP SIGNATURE----- Version: 2.1 iQBFAgUBK4lx8vFZTpBW/B35AQGnfwF/YdHtdc6B+oslFno9+rCowlph7GteEZF+ ot8jlZRA+gW+Sa1bpBUkV6ZryBlHYQMQ =KMZW -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind system, any replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi. *IMPORTANT server security update*, mail to update(a)anon.penet.fi for details.

1 0

Re: Unbreakable MacHD encryption
by mark＠coombs.anu.edu.au 23 Feb '93

23 Feb '93

I have used a product in the past called Hard Disk Deadbolt. It has from memory three encryption methods; quick-and-nasty hard-disk-deadbolt's-own (no idea on the security of this one) and DES. The first is fastest for stuff you dont want anyone to read but isnt super secret, whilst DES takes the longest. I liked the package all things considered. It was friendly, files didnt change size and it was speedy enough for my uses. Availability is unknown at this stage, ask in comp.sys.mac.* if you want. Mark mark(a)coombs.anu.edu.au

1 0

Rambo Lives
by deltorto＠aol.com 23 Feb '93

23 Feb '93

>>kelly(a)netcom.com >> >> [stuff removed] >> ...the military in general and the >>army , marines and and special intelligence agencies>, they >>are after all as their prime mission capable of extreme violence and the >>taking of human life, as a means of social control. >>Law enforcement seems to have very similiar mentality as well, >>with CONTROL being the agenda and reason for existance-- >>Suppose we think of guerilla products such as PGP and anoynmous >>posting mechanisms and forwarders in their larger social sense >>As behaviour modification for those who would have our privacy >>as well as our lives ...and thus the government's decision to consider PGP (a privacy mechanism) as "munitions." At first I thought it was outrageous, but it all makes curious sense somehow when you bop yourself on the head the right way, doesn't it? I say we should ensure that as many citizens as possible get ahold of PGP as soon as possible. After all, the NRA would have us believe that it's every citizen's right to "bear arms," so why shouldn't we (especially those who choose not to carry firearms like me) all have whatever sort of weapon we choose to "carry?" That's all for now, excuse me while I go hurl. All this crap really makes me a bit ill, to tell you the truth. I only want the same respect I give to other people, not a lot of static from a bunch of haircuts with sidearms. d2t PS: Keep this in mind the next time you see someone you love patronize a Rambo-style movie or play a game of shoot-'em-up Ninten do - this is where the Bad Guys get their funding, lads.

4 3

No Subject
by nowhere＠bsu-cs.bsu.edu 23 Feb '93

23 Feb '93

-----BEGIN PGP SIGNED MESSAGE----- Xavier hit the nail on the head -- my note was a subterfuge, intended to reveal the association between anonymous id's and email addresses. I think it's wrong for anon.penet.fi to operate this way. > DEADBEAT -----BEGIN PGP SIGNATURE----- Version: 2.1 iQBFAgUBK4lD7/FZTpBW/B35AQGiCQF9HFeDhXk7FV9mhIMh9zGmxblLvCt8bszr 4daRmyo8/cJMK7Y5V7kfQN05CEdJo6oc =KalQ -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind system, any replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi. *IMPORTANT server security update*, mail to update(a)anon.penet.fi for details.

1 0

Re: Trapdoors
by jim＠tadpole.com 23 Feb '93

23 Feb '93

> The specific instruction is the so-called "NSA instruction" which John Gilmore > identified some time ago. > > Sun Microsystems was ordered by the NSA to redesign their chips to capture > keys, which is why the SPARC processor was introduced. SPARC stands for > "Sun Processor Allowing Remote Capture." Interestingly enough, V9 SPARC has a population count (number of bits set in word) instruction that was put in specificly at the request of No Such Agency. Jim

6 5

Unforgotton topic
by fergp＠sytex.com 23 Feb '93

23 Feb '93

I realize that this has already been an old topic amonst you folks, but I just wanted to post a summary I found rather striking and an issue I know still leaves a bad taste in our collective mouths - "Threats to Privacy", "FBIs Wiretapping Proposal Thwarted", extracted from Boardwatch Magazine, February, 1993, pages 19 - 22 ( BBS Legislative Watch, Shari Steele, EFF) - "In a move that worried privacy experts, software manufacturers and telephone companies, the FBI proposed legislation to amend the Communications Act of 1934 to make it easier for the Bureau to perform electronic wiretappiing. The proposed legislation, entitled 'Digital Telephony,' would have required communications service providers and hardware manufacturers to make their systems 'tappable' by providing 'back doors' through which law enforcement officers could intercept communications. Furthermore, this capability would have been provided undetectably, while the communications was in progress, exclusive of any communications between other parties, regardless of the mobility of the target of the FBI's investigation, and without degradation of service. "The privacy implications are frightening. Today, all sorts of information about who we are and what we do, such as medical records, credit reports and employment data, are held on electronic databases. If these databases have government-mandated 'tappability,' this private information could be accessed by anyone tapping in. In addition, the language in the proposed bill is vague. This is especially troubling since, under the proposal, the Department of Justice (DOJ) can keep communications products off the market if it determines that these products do not meet the DOJ's own vague guidelines. This will probably result in increased costs and reduced competitiveness for service providers and equipment manufacturers, since they will be unlikely to add any features that may result in a DOJ rejection of their entire product. And to add insult to injury, the FBI proposal suggests that the cost of this wiretapping 'service' to the Bureau would have to be borne by the service provider itself, which ultimately means you and I will be paying higher user fees. "The Electronic Frontier Foundation organized a broad coalition of public interest and industry groups, from Computer Professionals for Social Responsibilty (CPSR) and the ACLU to AT&T and Sun Microsystems, to oppose the legislation. A white paper produced by the EFF and ratified by the coalition, entitled, 'An Analysis of the FBI Digital Telephony Proposal,' was widely distributed throughout the Congress. Senator Patrick Leahy (D-Vermont) and Representative Don Edwards (D-California), chairs of two key committees, referred to the EFF paper as they delayed the introduction of the FBI's proposal. As Leahy stated before the Senate, 'Our goal is to assist law enforcement,' but 'without jeopardizing privacy rights or frustrating the development of new communications technologies.' The Justice Department lobbied hard in the final days to get Congress to take up the bill before Congress adjourned, but the bill never even found a Congressional sponsor (and was therefore never officially introduced). The FBI will almost certainly reintroduce "Digital Telephony" when the 103rd Congress convenes in January." 8<------------ End Article -------------- Take a stance. Voice your opinion. Write your congressman! Paul Ferguson | "Sincerity is fine, but it's no Network Integration Consultant | excuse for stupidity." Alexandria, Virginia USA | -- Anonymous fergp(a)sytex.com (Internet) | sytex.com!fergp (UUNet) | 1:109/229 (FidoNet) | PGP public encryption key available upon request. --- fergp(a)sytex.com (Paul Ferguson) Access <=> Internet BBS, a public access internet site Sytex Communications, Arlington VA, 1-703-358-9022

1 0

Re: Beware of anon.penet.fi message!
by an5877＠anon.penet.fi 23 Feb '93

23 Feb '93

-----BEGIN PGP SIGNED MESSAGE----- Xavier hit the nail on the head -- my note was a subterfuge, intended to reveal the association between anonymous id's and email addresses. I think it's wrong for anon.penet.fi to operate this way. > DEADBEAT -----BEGIN PGP SIGNATURE----- Version: 2.1 iQBFAgUBK4lD7/FZTpBW/B35AQGiCQF9HFeDhXk7FV9mhIMh9zGmxblLvCt8bszr 4daRmyo8/cJMK7Y5V7kfQN05CEdJo6oc =KalQ -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind system, any replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi. *IMPORTANT server security update*, mail to update(a)anon.penet.fi for details.

1 0